CVE-2026-50659

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

PT-2026-63331

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility vulnerability discovered by ? in WordPress Npm hono versions = 4.0.0, 4.12.27...

EUVD-2026-42327

Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility...

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...

CVE-2026-44228

A flaw was found in RT, an issue and ticket tracking system. This stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript code into the system. When another user views the affected page, the injected script executes, potentially leading to...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

Cross-site Scripting (XSS)

Astro is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping of user-controlled values in transition:persist, transition:scope, and transition:persist-props directives, which allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered...

EUVD-2026-46166

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15145

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-61845

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-62111

Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10.1832 FOG versions prior to 1.6.0-beta.2313 Description The buildRow function in fogpage.class.php fails to perform HTML escaping when substituting data values into HTML table cell templates via str replace. An...

Amazon Linux 2 : python3, --advisory ALAS2-2026-3826 (ALAS-2026-3826)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3826 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF...

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory. - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of...

[20260806] - Core - XSS through schema.org outputs

Improper escaping flags lead to an XSS vector in schema.org markup outputs...

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Summary The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remoteimages. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize...

GHSA-HP3V-MFQW-H74C @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Summary The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remoteimages. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize...

Improper Encoding or Escaping of Output

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when...

CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...